Conventionally, dedicated apparatuses in which network functions and hardware were integrated were commonly used in communication equipment, but a network function virtualization (NFV) technique for providing a general-purpose server with a network function by making use of a virtualization technique has been attracting attention due to increased functions of general-purpose servers and the advancement of virtualization techniques.
By arranging a virtual network function (VNF) in a virtualization infrastructure (NFVI) using an NFV technique, a reduction in equipment cost, effective use of infrastructure resources, and an increase in the speed of service provision are expected. Furthermore, by providing the virtualization infrastructure with the network function, provision and deletion of the network function are easier, and therefore automization of network operation management is also expected.
The virtual network function is characterized in that the allocation of virtualization infrastructure resources for the VNF, such as distribution of VNF arrangement locations, and CPU and a memory resource amount for the VNF, is flexible. For this reason, for example, a technique of automatically scaling out or scaling in according to the communication amount or server load (auto-scale function) and a technique of automatically recovering from damage by causing a VNF to transition to another healthy server if an abnormality or damage is detected in the VNF (auto-heal function) have been considered. The auto-scale function and the auto-heal function are executed by being triggered by detection of an abnormality in a virtual network function, a virtualization infrastructure, or hardware.
FIG. 6 is a schematic diagram showing a configuration of a conventional network function monitoring system. A NFV infrastructure constituted by a hypervisor, a virtual machine, virtual switches, and the like is constructed on a general-purpose server, virtual network functions (VNFs) such as a firewall, a load balancer, and a router are included in the virtualization infrastructure, and a monitoring system monitors these virtual network functions and the virtualization infrastructure. Also, when an abnormality is detected in the monitoring system, abnormality notification is performed to the NFV control system, and after receiving the abnormality notification, the NFV control system operates the VNFs and the NFVI using the auto-scale function, the auto-heal function, and the like.
In this manner, in order to provide a highly-reliable network, it is essential that abnormalities in the network are found out rapidly. However, in particular, in performance monitoring of an NFVI, various types of performance information, such as a CPU usage rate, a memory usage rate, a band usage rate, and a disk usage rate, need to be monitored for a virtualization infrastructure, such as a hypervisor, a virtual machine, or a virtual switch, and therefore the items to be monitored become complicated.
Normally, by providing thresholds for the pieces of performance information, it is determined whether or not there is an abnormality, but settings become complicated accompanying enlargement of the monitoring region and diversification of the items being managed. For example, when an abnormality occurs in a hypervisor, an alarm for performing notification of an abnormality is generated from related virtual machines as well, and therefore as a result, the designation of the abnormal location and the influence range becomes difficult, there is a significant likelihood that the auto-heal function and the auto-scale function will not function appropriately, and there is concern that the real-time property will be lost. Furthermore, in the conventional detection procedure, there is a phenomenon in which an abnormality inside of a virtual switch that crosslinks virtual machines or the like is difficult to detect.
With respect to this kind of problem, PLT1 discloses a technique of detecting an abnormality by comprehensively analyzing the performance information of the NFVI. As shown in FIG. 7, based on the performance information during normal operation of the networks, an abnormality determination rule utilizing statistical processing and machine learning with no teacher is generated, and by comparing the performance information collected in a certain period and the abnormality detection rule, an abnormality detection function is provided.
Also, PLT2 discloses a technique of analyzing the temporal periodicity of the performance information of an apparatus being monitored, deriving an appropriate threshold value based on density distribution model information generated in each of the periods, and detecting an abnormality based on the threshold value.
Also, PLT3 discloses a technique of detecting an abnormality based on whether or not a correlative function generated at a time of normal operation has broken down, by deriving a correlative function for pieces of performance information of any two managed target apparatuses and a time series.